Emails being blocked by Gmail from office 365

Unfortunately, this is not one of those "agree to disagree" scenarios. In the world of InfoSec and IT in general, things are very black and white, no room for opinions. It is all binary choices. I do not want people reading the posts and getting mislead by wrong information.

Firtst though, I would strongly recommend doing "research" on who I am and what I do for a living: Michael Morell, CISSP - Royal Caribbean Group | LinkedIn before deciding on debating the issue further and disagreeing on technical realities.

Let me put this in a different way; if my current employer, Royal Caribbean, as their Enterprise Security Architect (there is only one of me in the company), and their Enterprise Mail Team that controls 100K+ RCCL email accounts, came to me with the 2 errors that you posted. My analysis of "why" would not change as the one and only solution to fix it. (SPF, DKIM, Sender reputation, cleaning up mail lists, throttling based on domain)

If they came to me regarding not being able to send to Gmail, my analysis of "why" would not change as the one and only solution to fix it. (DMARC).

The same exact solutions that I would do for a multi-national company like RCCL with 100K+ users, is the same exact solutions that I would do if a small, 1 person "mom and pop" company came to me via "DirectionWeb Inc." (my InfoSec consulting firm).

Scale has no bearing on the root causes and the fixes. Sure, you can do band-aids that "may" work in the short term. But as a professional and a CISSP, my job is to provide the correct and competent resolutions. Don't take my word for that, take ISC2's word in their Code of Ethics that we (CISSPs) must adhere to: ISC2 Code of Ethics

The jist is, this is a learning opportunity for you, and others reading this, to absorb knowledge from someone who is a literal expert in this field for now 26years. Someone who has built their own mailservers from postfix, sendmail, and the very first versions of Exchange Server "5.5". I hold other certs such as the CCSK, CCNP, RHCE and MCSE+I (since 1999).

My apologies Pavlína for being blunt (and this goes for everyone complaining about MSFT); but all because it is "hosted in the cloud" does not mean it does not require an understanding of how email servers works.

Having an "Exchange Server" (which is what O365 is) in the "cloud" is no different than building a machine in your home, (1) installing windows server on it, (2) make it a domain controller, (3) then install microsoft exchange server on it, (4) configure it for mail functions, and then finally (5) create mailboxes and users, and anything else that is not a default.

MSFT just took steps 1-4 away by doing that heavy lifitng work for you. You still need to do step 5 as well as DNS entries (which even then they have tools for that).

SO! If you are expecting them to do ALL the work for you, then do NOT use a hosted exchange service for a custom domain name. Get yourself a free personal gmail/yahoo/aol/hotmail address if you do not want to have to deal with any sort of work getting your email to work.

Again, sorry for being blunt, but this is a pet peeve of mine for people blaming others for their own lack of responsibility or knowledge.

Michael B. Morell, CISSP #431307 CCSK (he/him/his/sir)

DirectionWeb

Owner and Information Security Professional

Hi Joshua

It sounds like the issue you had was specific to the incorrect SPF record; where spammers were able to send as your domain. That caused you to get flagged by gmail.

The "true" root cause for everyone else, was because of google/yahoo requiring DMARC records published in DNS. They began enforcing it BEFORE they published the requirements. Which sent the O365 email sending world into a frenzied death spiral.

At first, creating a new SMTP connector and routing it directly into gmail seemed to "fix" the issue. As it seemed like gmail was having issues with IPv6. But that "fix" was just a temporary band-aid. Because the "real" solution was to add a DMARC record. (I myself was affected because when I migrated from my on-prem BIND servers over to godaddy dns a few years ago; I forgot to add in a dmarc record and never fixed it, until now)

With that said; your issue (and possibly others) was SPF. The rest of the herd, is DMARC related.

On that same note, if anyone is reading this; also enable DomainKeys and DKIM for your domain. This is how you set it up in O365.

https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide#configure-dkim-signing-of-outbound-messages-in-microsoft-365

Michael B. Morell, CISSP #431307 CCSK (he/him/his/sir)

DirectionWeb

Owner and Information Security Professional

I cannot thank you enough. I have been facing this issue for months and tried every single suggested solution, but yours was the only one that worked.

Hi Andrew and Saquib, I scatter the web and did everything that can be possible to troubleshoot and find what is causing this issue. I don't think there is a solution for this. It might be something or an update that Google did so people outside their organization can use their service.

There are my thoughts but I could be wrong.

If you happen to find a solution for this please shoot me an email at ******@brstore.us